August 02, 2011

Firm Can Sue for Email Barrage, Sixth Circuit Holds

Do you wonder what you could do if someone targets your company with a torrent of calls and emails? Wonder no more. You can sue under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, which creates both criminal penalties and a civil cause of action.

Due to a dispute over firings by Pulte, a home-builder, a union complained to the National Labor Relations Board. It also got members to make lots of calls to Pulte and send a great many emails to some of its execs:

LIUNA . . . bombarded Pulte's sales offices and three of its executives with thousands of phone calls and e-mails. To generate a high volume of calls, LIUNA both hired an auto-dialing service and requested its members to call Pulte. It also encouraged its members, through postings on its website, to "fight back" by using LIUNA's server to send e-mails to specific Pulte executives. Most of the calls and e-mails concerned Pulte's purported unfair labor practices, though some communications included threats and obscene language.

Yet it was the volume of the communications, and not their content, that injured Pulte. The calls clogged access to Pulte's voicemail system, prevented its customers from reaching its sales offices and representatives, and even forced one Pulte employee to turn off her business cell phone. The e-mails wreaked more havoc: they overloaded Pulte's system, which limits the number of e-mails in an inbox; and this, in turn, stalled normal business operations because Pulte's employees could not access business-related e-mails of send e-mails to customers and vendors.

The district court tossed Pulte's "transmission" claim under section 1030(a)(5)(A) of CFAA on the ground that the union didn't "intentionally cause damage" to a "protected computer". The Sixth Circuit begged to differ, ruling that "a transmission that weakens a sound computer system -- or, similarly, one that diminishes a plaintiff's ability to use data or a system -- causes damage." Id. at 7.

You may not think of tying up phone lines or a computer network as "damage", but CFAA defines it that way. See 18 U.S.C. § 1030(e)(8) (providing that "any impairment to the integrity or availability of data, a program, a system, or information" counts as "damage").